v20.19.4

nodejs/nodev20.19.4Jul 15, 2025by RafaelGSS

AI Summary

A security release addressing Windows path traversal vulnerabilities.

Key Highlights

CVE-2025-27210: Bypass of path traversal protection for Windows reserved device names

Full Release Notes




This is a security release.

### Notable Changes

* (CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()

### Commits

* \[[`db7b93fcef`](https://github.com/nodejs/node/commit/db7b93fcef)] - **(CVE-2025-27210)** **lib**: handle all windows reserved driver name (RafaelGSS) [nodejs-private/node-private#721](https://github.com/nodejs-private/node-private/pull/721)